{"affected":[{"defaultStatus":"unaffected","product":"Booking Package","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.7.34","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-106000","cwes":["CWE-284"],"description":"The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/4a29bfc9-741e-417f-a382-ff9b77fb1571/"}],"kev":null,"metrics":[],"modifiedAt":1793772024363,"publishedAt":1793772024363,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/4a29bfc9-741e-417f-a382-ff9b77fb1571/"}],"remediation":[],"revision":"2654e0fae86ed4b7b7769cd6244e0756aec46bf5a930c4aae6424604ee03505d","sources":[{"modifiedAt":1793772024363,"name":"CNA: WPScan","retrievedAt":1793776116252,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106000"}],"ssvc":null,"status":"published","title":"Booking Package < 1.7.34 - Unauthenticated Payment Bypass","updatedAt":1793776116252}